Acceptable Use Policy

This policy is part of the Terms of Service. It applies to everyone who uses Cusp, including Members of a team workspace and Hub Publishers. It also applies to what you direct an agent to do: an agent acting on your instructions is treated as you.

1. Don't break the law or harm peopleCopy Anchor Link

Don't use Cusp to:

• do anything illegal, or help anyone else do so;
• create, store or share child sexual abuse material, or any content that sexualises minors. We report this to the authorities;
• harass, threaten, stalk, defame, intimidate or incite violence against anyone, or promote terrorism or violent extremism;
• infringe intellectual property, privacy or other rights, including by scraping or processing personal data without a lawful basis;
• deceive people, for example through fraud, phishing, impersonation, fake reviews or scams;
• run influence operations or mass disinformation campaigns; or
• violate sanctions or export control laws.

2. Security work: only with permissionCopy Anchor Link

Cusp is a coding tool, and security work is part of coding. You may use Cusp for security research and testing, CTFs, defensive tooling and vulnerability analysis of systems you own or are authorised to test.

Don't use Cusp to:

• access, scan, probe or attack any system, network or account without authorisation;
• create, distribute or deploy malware, ransomware, spyware, botnets or credential stealers for use against others;
• carry out denial-of-service attacks or mass exploitation;
• build tools whose main purpose is to evade detection for malicious ends; or
• bypass security or authentication controls, including CAPTCHAs, on services you don't own.

3. Respect the service and other usersCopy Anchor Link

Don't:

• interfere with, disrupt or overload the Services, or try to get around rate limits, spend caps, plan limits, invite gates or usage metering;
• try to access other customers' data, workspaces, sessions or cloud runners, or break out of a sandbox or runner;
• probe or test the Cloud's security other than under our vulnerability disclosure policy;
• resell, sublicense or share access to the Managed Gateway, or use it to serve model access to people outside your workspace;
• create accounts in bulk or by automated means, share accounts, or use someone else's invitation;
• use cloud runners for cryptocurrency mining, open proxies, VPNs, spam, file sharing of infringing material, or long-running workloads unrelated to your agent's work; or
• use Cusp to send unsolicited bulk messages.

4. AI-specific rulesCopy Anchor Link

When you use models through Cusp, also follow the usage policies of the model provider (listed on AI and Model Providers). In particular, don't:

• use Output to develop or train a model that competes with the provider's models, where the provider's terms prohibit it;
• try to extract model weights, system prompts or training data, or jailbreak models to produce content these rules prohibit;
• present Output as written by a human where that would mislead people in a way that matters, such as in an academic or legal context, or where the law requires you to disclose AI involvement;
• use Cusp to make automated decisions that have legal or similarly significant effects on people (such as hiring, credit, housing, insurance or education decisions) without meaningful human review; or
• use Cusp for any practice prohibited by the EU AI Act, such as manipulative techniques that cause significant harm, social scoring, or untargeted scraping of facial images.

Cusp is not designed for, and must not be used to control, safety-critical systems where failure could lead to death, injury or serious environmental damage, such as medical devices, aircraft or weapons, without independent human verification and safety engineering.

5. Content you publishCopy Anchor Link

These rules apply to everything you publish or host with Cusp: public artifacts, shared sessions, Hub listings and reviews, and sites or apps you deploy.

• Don't publish anything sections 1–4 prohibit, or anything that's illegal in the UK, the EU or the US.
• Don't host phishing or credential-harvesting pages, malware or unwanted downloads, or pages that impersonate another person or brand.
• Don't run cryptocurrency miners, open proxies, anonymisers or VPN endpoints.
• Don't send spam or bulk email. Outgoing email (SMTP) from hosted apps is blocked unless we've enabled it for you.
• Don't try to evade our limits or scans, for example by using several accounts, or by hiding content behind CAPTCHAs or cloaking it from reviewers.
• Don't publish other people's personal data, secrets or credentials.
• Label clearly any content that's AI-generated and could be mistaken for real people or events (deepfakes).
• If your app has its own users, you're responsible for them and their data.

We scan Hub extensions before they're published, and we may hold or suspend reported content while a person reviews it, as described in section 15 of the Terms of Service.

6. If you break this policyCopy Anchor Link

We may remove content, limit features, suspend or close accounts, and report illegal activity to the authorities, as described in section 16 of the Terms of Service. We'll act in proportion to how serious the breach is and, unless the matter is urgent or the law prevents it, tell you what we did and why.

7. ReportingCopy Anchor Link

Report abuse to abuse@cusp.run and security issues to security@cusp.run. See our vulnerability disclosure policy.